util.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895
  1. /*
  2. * linux/ipc/util.c
  3. * Copyright (C) 1992 Krishna Balasubramanian
  4. *
  5. * Sep 1997 - Call suser() last after "normal" permission checks so we
  6. * get BSD style process accounting right.
  7. * Occurs in several places in the IPC code.
  8. * Chris Evans, <chris@ferret.lmh.ox.ac.uk>
  9. * Nov 1999 - ipc helper functions, unified SMP locking
  10. * Manfred Spraul <manfred@colorfullife.com>
  11. * Oct 2002 - One lock per IPC id. RCU ipc_free for lock-free grow_ary().
  12. * Mingming Cao <cmm@us.ibm.com>
  13. * Mar 2006 - support for audit of ipc object properties
  14. * Dustin Kirkland <dustin.kirkland@us.ibm.com>
  15. * Jun 2006 - namespaces ssupport
  16. * OpenVZ, SWsoft Inc.
  17. * Pavel Emelianov <xemul@openvz.org>
  18. */
  19. #include <linux/mm.h>
  20. #include <linux/shm.h>
  21. #include <linux/init.h>
  22. #include <linux/msg.h>
  23. #include <linux/smp_lock.h>
  24. #include <linux/vmalloc.h>
  25. #include <linux/slab.h>
  26. #include <linux/capability.h>
  27. #include <linux/highuid.h>
  28. #include <linux/security.h>
  29. #include <linux/rcupdate.h>
  30. #include <linux/workqueue.h>
  31. #include <linux/seq_file.h>
  32. #include <linux/proc_fs.h>
  33. #include <linux/audit.h>
  34. #include <linux/nsproxy.h>
  35. #include <asm/unistd.h>
  36. #include "util.h"
  37. struct ipc_proc_iface {
  38. const char *path;
  39. const char *header;
  40. int ids;
  41. int (*show)(struct seq_file *, void *);
  42. };
  43. struct ipc_namespace init_ipc_ns = {
  44. .kref = {
  45. .refcount = ATOMIC_INIT(2),
  46. },
  47. };
  48. #ifdef CONFIG_IPC_NS
  49. static struct ipc_namespace *clone_ipc_ns(struct ipc_namespace *old_ns)
  50. {
  51. int err;
  52. struct ipc_namespace *ns;
  53. err = -ENOMEM;
  54. ns = kmalloc(sizeof(struct ipc_namespace), GFP_KERNEL);
  55. if (ns == NULL)
  56. goto err_mem;
  57. err = sem_init_ns(ns);
  58. if (err)
  59. goto err_sem;
  60. err = msg_init_ns(ns);
  61. if (err)
  62. goto err_msg;
  63. err = shm_init_ns(ns);
  64. if (err)
  65. goto err_shm;
  66. kref_init(&ns->kref);
  67. return ns;
  68. err_shm:
  69. msg_exit_ns(ns);
  70. err_msg:
  71. sem_exit_ns(ns);
  72. err_sem:
  73. kfree(ns);
  74. err_mem:
  75. return ERR_PTR(err);
  76. }
  77. int unshare_ipcs(unsigned long unshare_flags, struct ipc_namespace **new_ipc)
  78. {
  79. struct ipc_namespace *new;
  80. if (unshare_flags & CLONE_NEWIPC) {
  81. if (!capable(CAP_SYS_ADMIN))
  82. return -EPERM;
  83. new = clone_ipc_ns(current->nsproxy->ipc_ns);
  84. if (IS_ERR(new))
  85. return PTR_ERR(new);
  86. *new_ipc = new;
  87. }
  88. return 0;
  89. }
  90. int copy_ipcs(unsigned long flags, struct task_struct *tsk)
  91. {
  92. struct ipc_namespace *old_ns = tsk->nsproxy->ipc_ns;
  93. struct ipc_namespace *new_ns;
  94. int err = 0;
  95. if (!old_ns)
  96. return 0;
  97. get_ipc_ns(old_ns);
  98. if (!(flags & CLONE_NEWIPC))
  99. return 0;
  100. if (!capable(CAP_SYS_ADMIN)) {
  101. err = -EPERM;
  102. goto out;
  103. }
  104. new_ns = clone_ipc_ns(old_ns);
  105. if (!new_ns) {
  106. err = -ENOMEM;
  107. goto out;
  108. }
  109. tsk->nsproxy->ipc_ns = new_ns;
  110. out:
  111. put_ipc_ns(old_ns);
  112. return err;
  113. }
  114. void free_ipc_ns(struct kref *kref)
  115. {
  116. struct ipc_namespace *ns;
  117. ns = container_of(kref, struct ipc_namespace, kref);
  118. sem_exit_ns(ns);
  119. msg_exit_ns(ns);
  120. shm_exit_ns(ns);
  121. kfree(ns);
  122. }
  123. #else
  124. int copy_ipcs(unsigned long flags, struct task_struct *tsk)
  125. {
  126. if (flags & CLONE_NEWIPC)
  127. return -EINVAL;
  128. return 0;
  129. }
  130. #endif
  131. /**
  132. * ipc_init - initialise IPC subsystem
  133. *
  134. * The various system5 IPC resources (semaphores, messages and shared
  135. * memory) are initialised
  136. */
  137. static int __init ipc_init(void)
  138. {
  139. sem_init();
  140. msg_init();
  141. shm_init();
  142. return 0;
  143. }
  144. __initcall(ipc_init);
  145. /**
  146. * ipc_init_ids - initialise IPC identifiers
  147. * @ids: Identifier set
  148. * @size: Number of identifiers
  149. *
  150. * Given a size for the ipc identifier range (limited below IPCMNI)
  151. * set up the sequence range to use then allocate and initialise the
  152. * array itself.
  153. */
  154. void __ipc_init ipc_init_ids(struct ipc_ids* ids, int size)
  155. {
  156. int i;
  157. mutex_init(&ids->mutex);
  158. if(size > IPCMNI)
  159. size = IPCMNI;
  160. ids->in_use = 0;
  161. ids->max_id = -1;
  162. ids->seq = 0;
  163. {
  164. int seq_limit = INT_MAX/SEQ_MULTIPLIER;
  165. if(seq_limit > USHRT_MAX)
  166. ids->seq_max = USHRT_MAX;
  167. else
  168. ids->seq_max = seq_limit;
  169. }
  170. ids->entries = ipc_rcu_alloc(sizeof(struct kern_ipc_perm *)*size +
  171. sizeof(struct ipc_id_ary));
  172. if(ids->entries == NULL) {
  173. printk(KERN_ERR "ipc_init_ids() failed, ipc service disabled.\n");
  174. size = 0;
  175. ids->entries = &ids->nullentry;
  176. }
  177. ids->entries->size = size;
  178. for(i=0;i<size;i++)
  179. ids->entries->p[i] = NULL;
  180. }
  181. #ifdef CONFIG_PROC_FS
  182. static const struct file_operations sysvipc_proc_fops;
  183. /**
  184. * ipc_init_proc_interface - Create a proc interface for sysipc types using a seq_file interface.
  185. * @path: Path in procfs
  186. * @header: Banner to be printed at the beginning of the file.
  187. * @ids: ipc id table to iterate.
  188. * @show: show routine.
  189. */
  190. void __init ipc_init_proc_interface(const char *path, const char *header,
  191. int ids, int (*show)(struct seq_file *, void *))
  192. {
  193. struct proc_dir_entry *pde;
  194. struct ipc_proc_iface *iface;
  195. iface = kmalloc(sizeof(*iface), GFP_KERNEL);
  196. if (!iface)
  197. return;
  198. iface->path = path;
  199. iface->header = header;
  200. iface->ids = ids;
  201. iface->show = show;
  202. pde = create_proc_entry(path,
  203. S_IRUGO, /* world readable */
  204. NULL /* parent dir */);
  205. if (pde) {
  206. pde->data = iface;
  207. pde->proc_fops = &sysvipc_proc_fops;
  208. } else {
  209. kfree(iface);
  210. }
  211. }
  212. #endif
  213. /**
  214. * ipc_findkey - find a key in an ipc identifier set
  215. * @ids: Identifier set
  216. * @key: The key to find
  217. *
  218. * Requires ipc_ids.mutex locked.
  219. * Returns the identifier if found or -1 if not.
  220. */
  221. int ipc_findkey(struct ipc_ids* ids, key_t key)
  222. {
  223. int id;
  224. struct kern_ipc_perm* p;
  225. int max_id = ids->max_id;
  226. /*
  227. * rcu_dereference() is not needed here
  228. * since ipc_ids.mutex is held
  229. */
  230. for (id = 0; id <= max_id; id++) {
  231. p = ids->entries->p[id];
  232. if(p==NULL)
  233. continue;
  234. if (key == p->key)
  235. return id;
  236. }
  237. return -1;
  238. }
  239. /*
  240. * Requires ipc_ids.mutex locked
  241. */
  242. static int grow_ary(struct ipc_ids* ids, int newsize)
  243. {
  244. struct ipc_id_ary* new;
  245. struct ipc_id_ary* old;
  246. int i;
  247. int size = ids->entries->size;
  248. if(newsize > IPCMNI)
  249. newsize = IPCMNI;
  250. if(newsize <= size)
  251. return newsize;
  252. new = ipc_rcu_alloc(sizeof(struct kern_ipc_perm *)*newsize +
  253. sizeof(struct ipc_id_ary));
  254. if(new == NULL)
  255. return size;
  256. new->size = newsize;
  257. memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size);
  258. for(i=size;i<newsize;i++) {
  259. new->p[i] = NULL;
  260. }
  261. old = ids->entries;
  262. /*
  263. * Use rcu_assign_pointer() to make sure the memcpyed contents
  264. * of the new array are visible before the new array becomes visible.
  265. */
  266. rcu_assign_pointer(ids->entries, new);
  267. __ipc_fini_ids(ids, old);
  268. return newsize;
  269. }
  270. /**
  271. * ipc_addid - add an IPC identifier
  272. * @ids: IPC identifier set
  273. * @new: new IPC permission set
  274. * @size: new size limit for the id array
  275. *
  276. * Add an entry 'new' to the IPC arrays. The permissions object is
  277. * initialised and the first free entry is set up and the id assigned
  278. * is returned. The list is returned in a locked state on success.
  279. * On failure the list is not locked and -1 is returned.
  280. *
  281. * Called with ipc_ids.mutex held.
  282. */
  283. int ipc_addid(struct ipc_ids* ids, struct kern_ipc_perm* new, int size)
  284. {
  285. int id;
  286. size = grow_ary(ids,size);
  287. /*
  288. * rcu_dereference()() is not needed here since
  289. * ipc_ids.mutex is held
  290. */
  291. for (id = 0; id < size; id++) {
  292. if(ids->entries->p[id] == NULL)
  293. goto found;
  294. }
  295. return -1;
  296. found:
  297. ids->in_use++;
  298. if (id > ids->max_id)
  299. ids->max_id = id;
  300. new->cuid = new->uid = current->euid;
  301. new->gid = new->cgid = current->egid;
  302. new->seq = ids->seq++;
  303. if(ids->seq > ids->seq_max)
  304. ids->seq = 0;
  305. spin_lock_init(&new->lock);
  306. new->deleted = 0;
  307. rcu_read_lock();
  308. spin_lock(&new->lock);
  309. ids->entries->p[id] = new;
  310. return id;
  311. }
  312. /**
  313. * ipc_rmid - remove an IPC identifier
  314. * @ids: identifier set
  315. * @id: Identifier to remove
  316. *
  317. * The identifier must be valid, and in use. The kernel will panic if
  318. * fed an invalid identifier. The entry is removed and internal
  319. * variables recomputed. The object associated with the identifier
  320. * is returned.
  321. * ipc_ids.mutex and the spinlock for this ID is hold before this function
  322. * is called, and remain locked on the exit.
  323. */
  324. struct kern_ipc_perm* ipc_rmid(struct ipc_ids* ids, int id)
  325. {
  326. struct kern_ipc_perm* p;
  327. int lid = id % SEQ_MULTIPLIER;
  328. BUG_ON(lid >= ids->entries->size);
  329. /*
  330. * do not need a rcu_dereference()() here to force ordering
  331. * on Alpha, since the ipc_ids.mutex is held.
  332. */
  333. p = ids->entries->p[lid];
  334. ids->entries->p[lid] = NULL;
  335. BUG_ON(p==NULL);
  336. ids->in_use--;
  337. if (lid == ids->max_id) {
  338. do {
  339. lid--;
  340. if(lid == -1)
  341. break;
  342. } while (ids->entries->p[lid] == NULL);
  343. ids->max_id = lid;
  344. }
  345. p->deleted = 1;
  346. return p;
  347. }
  348. /**
  349. * ipc_alloc - allocate ipc space
  350. * @size: size desired
  351. *
  352. * Allocate memory from the appropriate pools and return a pointer to it.
  353. * NULL is returned if the allocation fails
  354. */
  355. void* ipc_alloc(int size)
  356. {
  357. void* out;
  358. if(size > PAGE_SIZE)
  359. out = vmalloc(size);
  360. else
  361. out = kmalloc(size, GFP_KERNEL);
  362. return out;
  363. }
  364. /**
  365. * ipc_free - free ipc space
  366. * @ptr: pointer returned by ipc_alloc
  367. * @size: size of block
  368. *
  369. * Free a block created with ipc_alloc(). The caller must know the size
  370. * used in the allocation call.
  371. */
  372. void ipc_free(void* ptr, int size)
  373. {
  374. if(size > PAGE_SIZE)
  375. vfree(ptr);
  376. else
  377. kfree(ptr);
  378. }
  379. /*
  380. * rcu allocations:
  381. * There are three headers that are prepended to the actual allocation:
  382. * - during use: ipc_rcu_hdr.
  383. * - during the rcu grace period: ipc_rcu_grace.
  384. * - [only if vmalloc]: ipc_rcu_sched.
  385. * Their lifetime doesn't overlap, thus the headers share the same memory.
  386. * Unlike a normal union, they are right-aligned, thus some container_of
  387. * forward/backward casting is necessary:
  388. */
  389. struct ipc_rcu_hdr
  390. {
  391. int refcount;
  392. int is_vmalloc;
  393. void *data[0];
  394. };
  395. struct ipc_rcu_grace
  396. {
  397. struct rcu_head rcu;
  398. /* "void *" makes sure alignment of following data is sane. */
  399. void *data[0];
  400. };
  401. struct ipc_rcu_sched
  402. {
  403. struct work_struct work;
  404. /* "void *" makes sure alignment of following data is sane. */
  405. void *data[0];
  406. };
  407. #define HDRLEN_KMALLOC (sizeof(struct ipc_rcu_grace) > sizeof(struct ipc_rcu_hdr) ? \
  408. sizeof(struct ipc_rcu_grace) : sizeof(struct ipc_rcu_hdr))
  409. #define HDRLEN_VMALLOC (sizeof(struct ipc_rcu_sched) > HDRLEN_KMALLOC ? \
  410. sizeof(struct ipc_rcu_sched) : HDRLEN_KMALLOC)
  411. static inline int rcu_use_vmalloc(int size)
  412. {
  413. /* Too big for a single page? */
  414. if (HDRLEN_KMALLOC + size > PAGE_SIZE)
  415. return 1;
  416. return 0;
  417. }
  418. /**
  419. * ipc_rcu_alloc - allocate ipc and rcu space
  420. * @size: size desired
  421. *
  422. * Allocate memory for the rcu header structure + the object.
  423. * Returns the pointer to the object.
  424. * NULL is returned if the allocation fails.
  425. */
  426. void* ipc_rcu_alloc(int size)
  427. {
  428. void* out;
  429. /*
  430. * We prepend the allocation with the rcu struct, and
  431. * workqueue if necessary (for vmalloc).
  432. */
  433. if (rcu_use_vmalloc(size)) {
  434. out = vmalloc(HDRLEN_VMALLOC + size);
  435. if (out) {
  436. out += HDRLEN_VMALLOC;
  437. container_of(out, struct ipc_rcu_hdr, data)->is_vmalloc = 1;
  438. container_of(out, struct ipc_rcu_hdr, data)->refcount = 1;
  439. }
  440. } else {
  441. out = kmalloc(HDRLEN_KMALLOC + size, GFP_KERNEL);
  442. if (out) {
  443. out += HDRLEN_KMALLOC;
  444. container_of(out, struct ipc_rcu_hdr, data)->is_vmalloc = 0;
  445. container_of(out, struct ipc_rcu_hdr, data)->refcount = 1;
  446. }
  447. }
  448. return out;
  449. }
  450. void ipc_rcu_getref(void *ptr)
  451. {
  452. container_of(ptr, struct ipc_rcu_hdr, data)->refcount++;
  453. }
  454. static void ipc_do_vfree(struct work_struct *work)
  455. {
  456. vfree(container_of(work, struct ipc_rcu_sched, work));
  457. }
  458. /**
  459. * ipc_schedule_free - free ipc + rcu space
  460. * @head: RCU callback structure for queued work
  461. *
  462. * Since RCU callback function is called in bh,
  463. * we need to defer the vfree to schedule_work().
  464. */
  465. static void ipc_schedule_free(struct rcu_head *head)
  466. {
  467. struct ipc_rcu_grace *grace =
  468. container_of(head, struct ipc_rcu_grace, rcu);
  469. struct ipc_rcu_sched *sched =
  470. container_of(&(grace->data[0]), struct ipc_rcu_sched, data[0]);
  471. INIT_WORK(&sched->work, ipc_do_vfree);
  472. schedule_work(&sched->work);
  473. }
  474. /**
  475. * ipc_immediate_free - free ipc + rcu space
  476. * @head: RCU callback structure that contains pointer to be freed
  477. *
  478. * Free from the RCU callback context.
  479. */
  480. static void ipc_immediate_free(struct rcu_head *head)
  481. {
  482. struct ipc_rcu_grace *free =
  483. container_of(head, struct ipc_rcu_grace, rcu);
  484. kfree(free);
  485. }
  486. void ipc_rcu_putref(void *ptr)
  487. {
  488. if (--container_of(ptr, struct ipc_rcu_hdr, data)->refcount > 0)
  489. return;
  490. if (container_of(ptr, struct ipc_rcu_hdr, data)->is_vmalloc) {
  491. call_rcu(&container_of(ptr, struct ipc_rcu_grace, data)->rcu,
  492. ipc_schedule_free);
  493. } else {
  494. call_rcu(&container_of(ptr, struct ipc_rcu_grace, data)->rcu,
  495. ipc_immediate_free);
  496. }
  497. }
  498. /**
  499. * ipcperms - check IPC permissions
  500. * @ipcp: IPC permission set
  501. * @flag: desired permission set.
  502. *
  503. * Check user, group, other permissions for access
  504. * to ipc resources. return 0 if allowed
  505. */
  506. int ipcperms (struct kern_ipc_perm *ipcp, short flag)
  507. { /* flag will most probably be 0 or S_...UGO from <linux/stat.h> */
  508. int requested_mode, granted_mode, err;
  509. if (unlikely((err = audit_ipc_obj(ipcp))))
  510. return err;
  511. requested_mode = (flag >> 6) | (flag >> 3) | flag;
  512. granted_mode = ipcp->mode;
  513. if (current->euid == ipcp->cuid || current->euid == ipcp->uid)
  514. granted_mode >>= 6;
  515. else if (in_group_p(ipcp->cgid) || in_group_p(ipcp->gid))
  516. granted_mode >>= 3;
  517. /* is there some bit set in requested_mode but not in granted_mode? */
  518. if ((requested_mode & ~granted_mode & 0007) &&
  519. !capable(CAP_IPC_OWNER))
  520. return -1;
  521. return security_ipc_permission(ipcp, flag);
  522. }
  523. /*
  524. * Functions to convert between the kern_ipc_perm structure and the
  525. * old/new ipc_perm structures
  526. */
  527. /**
  528. * kernel_to_ipc64_perm - convert kernel ipc permissions to user
  529. * @in: kernel permissions
  530. * @out: new style IPC permissions
  531. *
  532. * Turn the kernel object @in into a set of permissions descriptions
  533. * for returning to userspace (@out).
  534. */
  535. void kernel_to_ipc64_perm (struct kern_ipc_perm *in, struct ipc64_perm *out)
  536. {
  537. out->key = in->key;
  538. out->uid = in->uid;
  539. out->gid = in->gid;
  540. out->cuid = in->cuid;
  541. out->cgid = in->cgid;
  542. out->mode = in->mode;
  543. out->seq = in->seq;
  544. }
  545. /**
  546. * ipc64_perm_to_ipc_perm - convert old ipc permissions to new
  547. * @in: new style IPC permissions
  548. * @out: old style IPC permissions
  549. *
  550. * Turn the new style permissions object @in into a compatibility
  551. * object and store it into the @out pointer.
  552. */
  553. void ipc64_perm_to_ipc_perm (struct ipc64_perm *in, struct ipc_perm *out)
  554. {
  555. out->key = in->key;
  556. SET_UID(out->uid, in->uid);
  557. SET_GID(out->gid, in->gid);
  558. SET_UID(out->cuid, in->cuid);
  559. SET_GID(out->cgid, in->cgid);
  560. out->mode = in->mode;
  561. out->seq = in->seq;
  562. }
  563. /*
  564. * So far only shm_get_stat() calls ipc_get() via shm_get(), so ipc_get()
  565. * is called with shm_ids.mutex locked. Since grow_ary() is also called with
  566. * shm_ids.mutex down(for Shared Memory), there is no need to add read
  567. * barriers here to gurantee the writes in grow_ary() are seen in order
  568. * here (for Alpha).
  569. *
  570. * However ipc_get() itself does not necessary require ipc_ids.mutex down. So
  571. * if in the future ipc_get() is used by other places without ipc_ids.mutex
  572. * down, then ipc_get() needs read memery barriers as ipc_lock() does.
  573. */
  574. struct kern_ipc_perm* ipc_get(struct ipc_ids* ids, int id)
  575. {
  576. struct kern_ipc_perm* out;
  577. int lid = id % SEQ_MULTIPLIER;
  578. if(lid >= ids->entries->size)
  579. return NULL;
  580. out = ids->entries->p[lid];
  581. return out;
  582. }
  583. struct kern_ipc_perm* ipc_lock(struct ipc_ids* ids, int id)
  584. {
  585. struct kern_ipc_perm* out;
  586. int lid = id % SEQ_MULTIPLIER;
  587. struct ipc_id_ary* entries;
  588. rcu_read_lock();
  589. entries = rcu_dereference(ids->entries);
  590. if(lid >= entries->size) {
  591. rcu_read_unlock();
  592. return NULL;
  593. }
  594. out = entries->p[lid];
  595. if(out == NULL) {
  596. rcu_read_unlock();
  597. return NULL;
  598. }
  599. spin_lock(&out->lock);
  600. /* ipc_rmid() may have already freed the ID while ipc_lock
  601. * was spinning: here verify that the structure is still valid
  602. */
  603. if (out->deleted) {
  604. spin_unlock(&out->lock);
  605. rcu_read_unlock();
  606. return NULL;
  607. }
  608. return out;
  609. }
  610. void ipc_lock_by_ptr(struct kern_ipc_perm *perm)
  611. {
  612. rcu_read_lock();
  613. spin_lock(&perm->lock);
  614. }
  615. void ipc_unlock(struct kern_ipc_perm* perm)
  616. {
  617. spin_unlock(&perm->lock);
  618. rcu_read_unlock();
  619. }
  620. int ipc_buildid(struct ipc_ids* ids, int id, int seq)
  621. {
  622. return SEQ_MULTIPLIER*seq + id;
  623. }
  624. int ipc_checkid(struct ipc_ids* ids, struct kern_ipc_perm* ipcp, int uid)
  625. {
  626. if(uid/SEQ_MULTIPLIER != ipcp->seq)
  627. return 1;
  628. return 0;
  629. }
  630. #ifdef __ARCH_WANT_IPC_PARSE_VERSION
  631. /**
  632. * ipc_parse_version - IPC call version
  633. * @cmd: pointer to command
  634. *
  635. * Return IPC_64 for new style IPC and IPC_OLD for old style IPC.
  636. * The @cmd value is turned from an encoding command and version into
  637. * just the command code.
  638. */
  639. int ipc_parse_version (int *cmd)
  640. {
  641. if (*cmd & IPC_64) {
  642. *cmd ^= IPC_64;
  643. return IPC_64;
  644. } else {
  645. return IPC_OLD;
  646. }
  647. }
  648. #endif /* __ARCH_WANT_IPC_PARSE_VERSION */
  649. #ifdef CONFIG_PROC_FS
  650. struct ipc_proc_iter {
  651. struct ipc_namespace *ns;
  652. struct ipc_proc_iface *iface;
  653. };
  654. static void *sysvipc_proc_next(struct seq_file *s, void *it, loff_t *pos)
  655. {
  656. struct ipc_proc_iter *iter = s->private;
  657. struct ipc_proc_iface *iface = iter->iface;
  658. struct kern_ipc_perm *ipc = it;
  659. loff_t p;
  660. struct ipc_ids *ids;
  661. ids = iter->ns->ids[iface->ids];
  662. /* If we had an ipc id locked before, unlock it */
  663. if (ipc && ipc != SEQ_START_TOKEN)
  664. ipc_unlock(ipc);
  665. /*
  666. * p = *pos - 1 (because id 0 starts at position 1)
  667. * + 1 (because we increment the position by one)
  668. */
  669. for (p = *pos; p <= ids->max_id; p++) {
  670. if ((ipc = ipc_lock(ids, p)) != NULL) {
  671. *pos = p + 1;
  672. return ipc;
  673. }
  674. }
  675. /* Out of range - return NULL to terminate iteration */
  676. return NULL;
  677. }
  678. /*
  679. * File positions: pos 0 -> header, pos n -> ipc id + 1.
  680. * SeqFile iterator: iterator value locked shp or SEQ_TOKEN_START.
  681. */
  682. static void *sysvipc_proc_start(struct seq_file *s, loff_t *pos)
  683. {
  684. struct ipc_proc_iter *iter = s->private;
  685. struct ipc_proc_iface *iface = iter->iface;
  686. struct kern_ipc_perm *ipc;
  687. loff_t p;
  688. struct ipc_ids *ids;
  689. ids = iter->ns->ids[iface->ids];
  690. /*
  691. * Take the lock - this will be released by the corresponding
  692. * call to stop().
  693. */
  694. mutex_lock(&ids->mutex);
  695. /* pos < 0 is invalid */
  696. if (*pos < 0)
  697. return NULL;
  698. /* pos == 0 means header */
  699. if (*pos == 0)
  700. return SEQ_START_TOKEN;
  701. /* Find the (pos-1)th ipc */
  702. for (p = *pos - 1; p <= ids->max_id; p++) {
  703. if ((ipc = ipc_lock(ids, p)) != NULL) {
  704. *pos = p + 1;
  705. return ipc;
  706. }
  707. }
  708. return NULL;
  709. }
  710. static void sysvipc_proc_stop(struct seq_file *s, void *it)
  711. {
  712. struct kern_ipc_perm *ipc = it;
  713. struct ipc_proc_iter *iter = s->private;
  714. struct ipc_proc_iface *iface = iter->iface;
  715. struct ipc_ids *ids;
  716. /* If we had a locked segment, release it */
  717. if (ipc && ipc != SEQ_START_TOKEN)
  718. ipc_unlock(ipc);
  719. ids = iter->ns->ids[iface->ids];
  720. /* Release the lock we took in start() */
  721. mutex_unlock(&ids->mutex);
  722. }
  723. static int sysvipc_proc_show(struct seq_file *s, void *it)
  724. {
  725. struct ipc_proc_iter *iter = s->private;
  726. struct ipc_proc_iface *iface = iter->iface;
  727. if (it == SEQ_START_TOKEN)
  728. return seq_puts(s, iface->header);
  729. return iface->show(s, it);
  730. }
  731. static struct seq_operations sysvipc_proc_seqops = {
  732. .start = sysvipc_proc_start,
  733. .stop = sysvipc_proc_stop,
  734. .next = sysvipc_proc_next,
  735. .show = sysvipc_proc_show,
  736. };
  737. static int sysvipc_proc_open(struct inode *inode, struct file *file)
  738. {
  739. int ret;
  740. struct seq_file *seq;
  741. struct ipc_proc_iter *iter;
  742. ret = -ENOMEM;
  743. iter = kmalloc(sizeof(*iter), GFP_KERNEL);
  744. if (!iter)
  745. goto out;
  746. ret = seq_open(file, &sysvipc_proc_seqops);
  747. if (ret)
  748. goto out_kfree;
  749. seq = file->private_data;
  750. seq->private = iter;
  751. iter->iface = PDE(inode)->data;
  752. iter->ns = get_ipc_ns(current->nsproxy->ipc_ns);
  753. out:
  754. return ret;
  755. out_kfree:
  756. kfree(iter);
  757. goto out;
  758. }
  759. static int sysvipc_proc_release(struct inode *inode, struct file *file)
  760. {
  761. struct seq_file *seq = file->private_data;
  762. struct ipc_proc_iter *iter = seq->private;
  763. put_ipc_ns(iter->ns);
  764. return seq_release_private(inode, file);
  765. }
  766. static const struct file_operations sysvipc_proc_fops = {
  767. .open = sysvipc_proc_open,
  768. .read = seq_read,
  769. .llseek = seq_lseek,
  770. .release = sysvipc_proc_release,
  771. };
  772. #endif /* CONFIG_PROC_FS */